# US 2018/0324148 A1 · Internet of things (iot) device firewalling

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2018/0324148 A1
- Document ID: US20180324148A1
- Status: Published application
- Kind: A1
- Application number: 15/660,837
- Filed: 2017-07-26
- Published: 2018-11-08
- Earliest claimed: 2017-05-08
- Assignees: T-Mobile USA, Inc.
- Applicants: T-Mobile USA, Inc.
- Inventors: Andrew Lee Watts
- Web page: https://patentgrep.com/patent/US20180324148A1

## CPC

- H04W 12/088: using filters or firewalls
- G06F 8/65: Updates (security arrangements therefor G06F21/57)
- G06F 9/4416: {Network booting; Remote initial program loading [RIPL]}
- G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures
- H04L 41/0813: characterised by the conditions triggering a change of settings
- H04L 41/0823: characterised by the purposes of a change of settings, e.g. optimising configuration for enhancing reliability (for optimising operational conditions of wireless networks H04W24/02)
- H04L 63/0245: {Filtering by information in the payload}
- H04L 63/0263: {Rule management}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/105: {Multiple levels of security}
- H04L 65/1016: IP multimedia subsystem [IMS]
- H04W 4/02: Services making use of location information
- H04W 12/069: using certificates or pre-shared keys
- H04W 16/10: Dynamic resource partitioning
- H04W 72/0453: Resources in frequency domain, e.g. a carrier in FDMA
- G06F 2221/033: Test or assess software
- G06F 2221/2113: Multi-level security, e.g. mandatory access control
- H04W 72/541: using the level of interference
- H04W 72/542: using measured or perceived quality
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A network hub may be configured to implement a firewall policy in order to restrict access by designated applications executing on the network hub to particular Internet of Things (IoT) data from designated IoT devices. A network hub may receive data packets from an IoT device, analyze the data packets against a firewall policy stored in memory of the network hub to determine whether an application executing on the network hub is allowed to receive at least a portion of data within the data packets, and allow or deny the application access to at least some of the data based at least in part on the firewall policy.

## Claims

### Claim 1

A computer-implemented method implemented by a network hub, the method comprising:
receiving data packets from an Internet of Things (IoT) device;
analyzing the data packets against a firewall policy stored in memory of the network hub to determine:
an application executing on the network hub that is to receive at least a portion of data within the data packets, and
whether the application is allowed to receive some or all of the data within the data packets; and
denying the application access to a subset of the data within the data packets based at least in part on the firewall policy.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, wherein:
the data within the data packets is organized into a plurality of data fields;
the analyzing of the data packets against the firewall policy comprises determining a subset of the plurality of data fields to which the application is not allowed access; and
the subset of the data to which the application is denied access comprises the subset of the plurality of data fields.

### Claim 3 (depends on 1)

The computer-implemented method of claim 1, wherein the denying the application access to the subset of the data comprises:
transforming the data into modified data by at least one of (i) masking the subset of the data, (ii) deleting the subset of the data, or (iii) replacing the subset of the data with generic data; and
providing the modified data to the application.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1, wherein:
the firewall policy specifies:
one or more first applications that are to be denied access to data packets received from the IoT device; and
one or more second applications that are to be provided access to at least some data within data packets received from the IoT device; and
the application is included in the one or more second applications.

### Claim 5 (depends on 1)

The computer-implemented method of claim 1, further comprising:
allowing the application access to a remainder of the data within the data packets based at least in part on the firewall policy;
receiving, from a mobile device over a computer network, a request to receive information from the application;
generating the information based at least in part on the remainder of the data; and
sending the information over the computer network to the mobile device.

### Claim 6 (depends on 1)

The computer-implemented method of claim 1, wherein:
the network hub is situated in a dwelling; and
the IoT device comprises a sensor in or on the dwelling.

### Claim 7

A network hub comprising:
one or more processors; and
memory storing a firewall policy and instructions that, when executed by the one or more processors, cause the network hub to:
receive data packets from an Internet of Things (IoT) device;
analyze the data packets against the firewall policy to determine whether an application executing on the network hub is allowed to receive at least a portion of data within the data packets; and
deny the application access to at least some of the data within the data packets based at least in part on the firewall policy.

### Claim 8 (depends on 7)

The network hub of claim 7, wherein:
the firewall policy indicates that the application is to be denied access to data packets received from the IoT device; and
denying the application access to at least some of the data within the data packets comprises denying the application access to all of the data within the data packets.

### Claim 9 (depends on 7)

The network hub of claim 7, wherein:
the firewall policy indicates that the application is to be provided access to at least some of the data within the data packets received from the IoT device; and
denying the application access to at least some of the data within the data packets comprises denying the application access to a subset of the data within the data packets.

### Claim 10 (depends on 9)

The network hub of claim 9, wherein:
the data within the data packets is organized into a plurality of data fields;
analyzing the data packets against the firewall policy comprises determining a subset of the plurality of data fields to which the application is not allowed access; and
the subset of the data to which the application is denied access comprises the subset of the plurality of data fields.

### Claim 11 (depends on 9)

The network hub of claim 9, wherein denying the application access to the subset of the data comprises:
transforming the data into modified data by at least one of (i) masking the subset of the data, (ii) deleting the subset of the data, or (iii) replacing the subset of the data with generic data; and
providing the modified data to the application.

### Claim 12 (depends on 9)

The network hub of claim 9, the instructions, when executed by the one or more processors, further cause the network hub to:
allow the application access to a remainder of the data within the data packets based at least in part on the firewall policy;
receive, from a mobile device over a computer network, a request to receive information from the application;
generate the information based at least in part on the remainder of the data; and
send the information over the computer network to the mobile device.

### Claim 13 (depends on 7)

The network hub of claim 7, wherein:
the network hub is situated in a dwelling; and
the IoT device comprises a sensor in or on the dwelling.

### Claim 14

One or more non-transitory computer-readable media storing computer-executable instructions that, when executed, cause one or more processors of a network hub to perform acts comprising:
receiving data packets from an Internet of Things (IoT) device;
analyzing the data packets against the firewall policy to determine whether an application executing on the network hub is allowed to receive at least a portion of data within the data packets; and
denying the application access to at least some of the data within the data packets based at least in part on the firewall policy.

### Claim 15 (depends on 14)

The one or more non-transitory computer-readable media of claim 14, wherein:
the firewall policy indicates that the application is to be denied access to data packets received from the IoT device; and
the denying the application access to at least some of the data within the data packets comprises denying the application access to all of the data within the data packets.

### Claim 16 (depends on 14)

The one or more non-transitory computer-readable media of claim 14, wherein:
the firewall policy indicates that the application is to be provided access to at least some of the data within the data packets received from the IoT device; and
the denying the application access to at least some of the data within the data packets comprises denying the application access to a subset of the data within the data packets.

### Claim 17 (depends on 16)

The one or more non-transitory computer-readable media of claim 16, wherein:
the data within the data packets is organized into a plurality of data fields;
the analyzing of the data packets against the firewall policy comprises determining a subset of the plurality of data fields to which the application is not allowed access; and
the subset of the data to which the application is denied access comprises the subset of the plurality of data fields.

### Claim 18 (depends on 16)

The one or more non-transitory computer-readable media of claim 16, wherein the denying the application access to the subset of the data comprises:
transforming the data into modified data by at least one of (i) masking the subset of the data, (ii) deleting the subset of the data, or (iii) replacing the subset of the data with generic data; and
providing the modified data to the application.

### Claim 19 (depends on 16)

The one or more non-transitory computer-readable media of claim 16, the acts further comprising:
allowing the application access to a remainder of the data within the data packets based at least in part on the firewall policy;
receiving, from a mobile device over a computer network, a request to receive information from the application;
generating the information based at least in part on the remainder of the data; and
sending the information over the computer network to the mobile device.

### Claim 20 (depends on 14)

The one or more non-transitory computer-readable media of claim 14, wherein:
the network hub is situated in a dwelling; and
the IoT device comprises a sensor in or on the dwelling.